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(Rev. 06-04-2007) 


i i 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Cyber 

Los Angeles 

From: Los Angeles 

CY-1 

Contact: 


Approved By: 
Drafted By: 


Case ID #A 


Title: 


UNSUB 
CHU 




Date: 


Attn: 
Attn: 


SSA [ 


CY-1 


]*V/ 


Imwb 


■E—SC-IE-N-TQLO GY - VICTIM 


Computer Intrusion 
0: LA 


01/31/2008 

I 


Synopsis: To open the abov e titled case with SA E 

TFO USSS SA | | co-case agents. 


] and 


Details: On January 18, 2008, a denial of service attack was 

launched against several Church of Scientolgoy web sites. The 
attack brought down the entire site on several occasions, forced 
the CjaUrch to move its site to outside servers, and to hire 
j^-t^drighelp to defend against the attack. A group named 
Agonymous^ has claimed responsibility for the attack and has posted 
evera1 videos discussing the attack and vowing to continue. 

Writer requests this case be opened. 



b3 

b6 

b7C 

b7E 


b6 

b7C 


b6 

b7C 

b7E 








(>t 




To: Cyber From: L os Angeles 


Re: [ 


01/31/2008 



b3 

b7E 


LEAD (s) : 

Set Lead 1: (Info) 

CYBER 


AT WASHINGTON, D.C. 
Read and clear. 


♦♦ 


2 









FD-919 (Rev. 06-05-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Los Angeles 

From: Los Angeles 

CY-1 

Contact: Q 
Approved By: ~ 


Date: 02/08/2008 


Drafted By: 


Case ID 



Title: VICTIM NOTIFICATION FORM 

Synopsis: Victim Contact Information 


Reference: 


Details: 


VnsCase# 

CAgtName 

PContact 

BusName 

BusEIN 

BusAcct 

VicFirN 

VicMidN 

VicLastN 

SSAN 

VicDate 

VicDOD 

VicMinor 

DOB 

Race 

Sex 

Addr 

Addr2 

City 

State 

Country 

Zip 

Email 

HPhone 

Fax 



Bus 
000000000 


mess 




20080118 


b7E 







To: Los Angeles Fr om: Los Angeles 

Re: I I 02/08/2008 


VWrkAddr 

VWrkadd2 

VWrkCity 

VWrkSt 

VWrkCtry 

VWrkZip 

WEmail 

WPhone 

WFax 

VicPager 

NOKFirN 

NOKMidN 

NOKLastN 

NOKRel 

NOKAddr 

NOKAddr2 

NOKCity 

NOKState 

NOKCtry 

NOKZip 

NOKHEmal 

NOKWEmal 

NOKHPho 

NOKWPho 

NOKHFax 

NOKWFax 

NOKPager 

GrdFirN 

GrdMidN 

GrdLastN 

GrdRel 

GrdAddr 

GrdAddr2 

GrdCity 

GrdState 

GrdCtry 

GrdZip 

GrdHEmal 

GrdWEmal 

GrdHPho 

GrdWPho 

GrdHFax 

GrdWFax 

GrdPager 

PropRet 

TotLoss 

Lang. 

Disable 


3055 Wilshire Blvd 

Suite 900 

Los Angeles 

CA 

US 

90010_ 


N 

000000000 

EN 








Date: 11/25/08 


Time: 19:05 


# 

Automated Serial Permanent Charge-Out 
FD-5a (1-5-94) 


Case ID: | | 

Description of Document: 

Type : FD919 

Date : 02/08/08 

To : LOS ANGELES 

From : LOS ANGELES 

Topic: VICTIM CONTACT INFORMATION 


Reason for Permanent Charge-Out: 

document re-uploaded as an an FD919 (not as an EC as previously done) 
Employee: | | 
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FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 02 /19 72008 



















(Rev. 06-04-2007) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 

To: Cyber 

International Operations 


Los Angeles 


From: Canberra 

Contact: ALAT 


Date: 03/12/2008 


Attn: 

Attn: 


Attn: 


SSA I 

Asia Unit 

UC I 

SSA 

FOS 

Squad CY-1 
SA I 



VICTIM 



Approved By: 
Drafted By: 


Case ID #: 


Title: UNSUB(S) 

CHURCH OF SCIENTOLOGY 
COMPUTER INTRUSION 
00: LA 

Synopsis : To provide I 


Administrative: Reference teleph one cal l from I 

_ to ALAT | Legat 

Canberra, on 02 /24/08. Also reference telephone call from Legat 
I Legat Canberra, to SA | | FBI Los 

Angeles, on 02/25/08. 

Enclosure(s) : Enclosed for the Los Angeles Division is I I 


Deta ils: On 02/24/ 08, I I contacted 

ALAT I I regarding a US Federal Grand Jury subooena 


This subpoena req uested 



After 


consulting with SA |_ 

determined the subpoena 


FBI Los An 




end EC/letter/fax (Secure_) 

nnclosure(/rAnachmem(s^ / &ssc. 


















This information is provided for whatever action is 
deemed appropriate. 


2 







To: 
Re: 


Cyber Froiff 


Canberra 
U 03/12/2008 


LEAD(s): 

Set Lead Is (Info) 


For your information. 

Set Lead 2: (Discretionary) 

LOS ANGELES 

AT LOS ANGET.ES. CA 

For action deemed appropriate. 









(Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 03/06/2008 

I ^ I at Iowa 

State University, was interviewed via telephone from his place of 
employment. After being advised of the identity o f the 
interviewing agent and the nature of the interview I I provided 

the following information: 

| | assisted in provided document s to the FBI pursuant 

to a subpoena. With regard to those documents | | explained, 

the IP address 64.113.75.180 goes back to a residence hall at Iowa 
State University. The connection could be either wireless or 
through a wall jack. The computer assigned that IP address 
indicating connections to the Scientology website URL and/or IP is 
j;he„personal ly bwn compute r of a student at the University named 

_ I 1 knows it is I 1 computer because when 

I I first connected to the Iowa State computer network he 

had to register his computer using the MAC address and establish a 
user name and password, which is why the logs of the activity 
betwee n the Universi ty and Sci entology have his name included in 
them. | ~1 user ID is | | There are no help desk 

tickets for this user ID. 

I 1 stated that there could be missing data on the 

Universities side with regard to all the possible connections. 


& 


investigation on 03/03/08 at Los Angeles, CA 


(telephonically) 


Date dictated 


by SA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside vour agency._ 





(Rev. 06-04-2007) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To : Newark 

Omaha 

Philadelphia 

From: Los Angeles 

CY-1 

Contact: [ 

Approved By: I 


Drafted By: 


Date: 


05/20/2008 


Attn: Trenton RA - Cyber Supervisor 
Attn: Grand Island RA - Cyber Supervisor 
Attn: Scranton RA - Cyber Supervisor 



Case ID # 

Title: UNSUB(S) 

CHURCH OF SCIENTOLOGY - VICTIM 
Computer Intrusion 
00: LA 

Synopsis: To set a lead to Newark, Omaha, and Philadelphia to 

conduct witness/subject interviews related to the computer attack 
described below. 

Details: On January 18, 2008, a denial of service attack was 

launched against several Church of Scientolgoy ("COS") websites. . 
The attack brought down the entire site on several occasions, 
forced the COS to move its site to outside servers, and forced 
the COS to hire outside help to defend against the attack. A 
group named Anonymous has claimed responsibility for the attack 
and has posted several videos on YouTube discussing the attack 
and vowing to continue. 

Investigation into the attack has identified several 
subjects throughout the United States including the following: 



/ SSAN: I_ 

( Tel : l ~ 

\Home Address: 


I I was a | at Iowa State University at 
the time of the attack and resided m a residence hall on campus. 
The spring semester ended May 9, 2008. The address listed above 
is his permanent address, likely that of | 

has no other addr esses listed. An Internet Protocol ("IP") 
address linked to _ through computer records provided 


b6 

b7C 

b7E 







Omaha 


To: Attn: Tn^hton RA - Cyber Supervisor 

From: Los Angeles 

Re: I I 05/20/2008 


by Iowa State,* hit COS websites hundreds of thousands of times 
across three different attacks. 

r v i 


Tel: 

Home Address: 






] NJ [ 


] 


J was~a—s-tuden'tr~at Drexel University at the time 
of the attack and resided in a residence hall on campus (same 


hall but different room as 


below). The address 


listed above is h is permanent address, likely that of □ 

I I has no other addresses listed. An IP address 

linked to I I through computer records provided by Drexel, 

hit COS websites over 
attacks. 


1 million times across three different 


1 


Tel: I ~ 

Home Address: |_ 


]_Z 



[ 


J was 


~a ~s tudent~a-t-Drexel, Uniyersity .at the time of 
the attack and resided in a residence hall on campus (same hall 


but different room as f I T he address listed abov e is his 

permanent address, likely that of I I ha s no 

other addresses listed. An IP address linked to through 

computer records provided by Drexel, hit COS websites over 1 
million times across three different attacks. 








To: Attn: Tfgnton RA - Cyber Supervisor" 

From: Los Angeles 

Re: I I 05/20/2008 


Omaha 


LEAD(s): 

Set Lead 1: (Action) 


OMAHA 


Interview 

Tel :| I at his Home Address. |_ 

NE and ask the following questions 


It |_| does not currently reside at the location, 

please interview any relative or person with knowledge as to his 
whereabouts and provide any contact information available. 

Set Lead 2: (Action) 

NEWARK 


Int erview I 
Address, | 

following questions: 


I at his Home 
and ask the 









Omaha 


b3 

b7E 


To: 
From: 
Re: T 


Attn: T^Siton RA - Cyber Supervisor 
Los Angeles 

I 05/20/2008 









4 - » 


To: 
From: 
Re: T 


• • 

Attn: Trenton RA - Cyber Supervisor Omaha 

Los Angeles 

I 05/20/2008 


b3 

b7E 



If I I does not currently reside at the location, please 
interview any relative or person with knowledge as to his 
whereabouts and provide any contact information available. 


♦♦ 



5 








FEDERAL BUREAU OF INVESTIGATION 


Precedence s ROUTINE 
To: Los Angeles 

From: New York 


Date: 07/14/2008 

Attn: SA | | CY-1 



b3 

b6 

b7C 

b7E 


Title: UNSUB(S) . 

CHURCH OF SCIENTOLOGY - VICTIM - 2 % 
COMPUTER INTRUSION 
00: LA 


Reference: 


b3 

b7E 


b6 


Synopsis: To document covering of lead. 

Details: On July 2, 2 008, SA | | coordinated resources between the b7c 

Los A ngeles and New Y ork Divisions of ECTF and FBI. An email was sent 
to SA I I (ECTF-LA) an d SA I ~l (ECT F-NY) , 


indicating that SA 
would assist in the search. 


and SA |_ 


from FBI-NY 


SSA's for FBI-LA, FBI-NY and ECTF-NY were 
copied on the email, and the necessary operational information was 
provided to SA | | and SA | | 


New York considers this lead covered. 









V 


b3 

b7E 


• # 

" To: Los Angeles Fr om: New York 

Re: | I 07/14/2008 

LEAD (s) : 

Set Lead 1: (Info) 

LOS ANGELES 

AT LOS ANGELES. CALIFORNIA 
Read and clear. 

♦♦ 


2 
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FD-302 (Rev. 10-6-95) 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07 /24 /2008 


On Ju ly 23, 2008, 

| social s ecurity account number[ 


"I date of birth 

J of □ 


interview, |_ 


and 


1 PA, was interviewed b y Special Agents 


___ Prior to the 

J was advised of the interviewing agents' identities 
and purpose of the interview. He thereafter stated the following: 


_ I Drexel University 

I completed two years at Drexel majoring in Mechanical 
Engineering. The last nine months at Drexel his room mate was 
I I stated [ I was majoring in Information 

Technology but was not sure of the minor. 


I I heard about the inte rnet group "anonymous" through 
I 1 According to I I and approximately 20 other 

individuals at Drexel were upset ab out a video featuring movie 
actor TOM CRUISE. The group, which l~ I knew no other names of, 
protested at the CHURCH OF SCIENTOLOGY (COS) located in 
Philadelphia. The group met at City hall then went, to the protest. 

I I stated he was not a member of the group "anonymous" nor did he 
attend the protests. 

The only other individual I I believes may be a member 
of "anonymou s" is | | (spel ling provided by I I . 

Accordi ng to | | were cl ose frie nds and talked 

often. | | resided next door to I 1 and I I at Drexel. 


I I advised in approximately January this year, 
went to various websites looking for programs to initiate DDOS 
attacks. He provided the following sites: 

4chan.org 

7chan.org 

711chan.org 

I I was a ble to locate a program; I I did not know 

the name of it. I I stated he saw the program and described a 
"nifty" screen that came up where you wold input the target IP 
address and several other pieces of inform ation and it would send 
"packets" to the site. According to | | for appr oximately a week 

straight in late January or early February, I I and the group 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


Investigation on 7/23/2008 at Scranton, PA 


Date dictated 7/24/2008 b3 

b6 

b7C 

b7E 


File # j_ 

by 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 







FD-302a (Rev. 10-6-95) 


b3 

b7E 


Continuation of FD-302 of 


2008 


"anonymous" sent two large D DOS atta cks and several smaller attacks 
against t he COS. I I knows I 1 to own a Mac Book and a Dell 

Desktop. I I used both computers in their room. The DDOS_ 

attack s were se nt using the Dell computer. On one occasion, I I 
saw on I I monitor approximately 15 of the "nifty" windows. 


The win dows were downsized and all running at the same time and 
I I told him they were directed toward COS. 


I I believes I I uses AOL Instant Messenger (AIM) to 

communicate with his friend s at Drexel and IRC to communicate with 
the group anonymo us. I I does not know his sreen/nick names. He 
did state I I has a myspace account and thinks it 1 s I I 

or similar . I I mvspace account can be fo und by just h is name 

I I and it is not set to private. I advised I I 

may be on his frie nds list, (writer went to I I myspace acc ount 

and locat ed friend I I 

friend ID I I writer believes this to be I I account) . 


b6 

b7C 


b6 

b7C 


I I stated he was not involved in any of the DDOS 
attacks against the COS and knows v ery litt le about computers. He 
further stated, I I did use his | ~| computer on occasion to 

complete and print school work. 


b6 

b7C 






FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07 /17/2008 


_ 1 I date of birth I I SSAN 

I Nebraska., was interviewed at his 

residence. After being advised of the nat ure of the in terview, and 
the identities of the interviewing Agents, I I provided the 

following information: 

I I stated that has lived at his current 

residence for about I I He sta ted that a total of six 

people live in the house. I I stated that he is c urrently 

look ing for a job . Prior to moving to I I resided 

with I I at | | Nebraska. 

I I recently completed his freshman year at Iowa State 

University (ISU) where he was majoring in Aerospace Engineering. 

I I stated that he did not plan to return to ISU 


I I stated that he did not plan to return to I SU 

and that he planned to enroll l ocally at ["" " — — — j 

I _ I stated that he wasn't returning to 

I I because his inte rest level wa s low and the out of state tuition 
was very expensive. I I stated that he took out loans to 

pay for his tuition. 


I I was asked if he was familiar with the 

Internet group called ANONYMOUS. I I said he has visited 

some of the same websites as the group's membership. I I 

said the gro up was made up of people with no real agenda. 

I I stated the group communi cated via an image board on the 

website www.4chan.org . | | stated that he hasn' t been on 

the message board in at least five months. I I stated the 

name of the board is "RANDOM" . He stated that various subjects 
were discussed on the board such as computer gear, tech questions, 
etc. 

I I was asked about his computer skills. He 

stated that he is a Microsoft Windows guy and specifically Windows 
VISTA. He s tated that he hates the Linux operating system. 

I I stated that he would of ten answer technical questions 

on the message board. I I stated that the postings on the 

message board were all anonymous. I I also viewed the 

website www.7chan.ora which he stated is similar in nature to 
www.4chan.org. 


Investigation on 07/17/2008 at 


Nebraska 


File # |_ 

SA 
by SA 


Date dictated 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency;, 
it and its contents are not to be distributed outside your agency. 
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FD-302a (Rev. 10-6-95) 


Continuation of FD-302 of 


]_.On 07/17/2008 .Page _2 


I | was asked if he communicated with any of the 

group 1 s memb ers "offline" meaning not on the www.4chan.org website. 

I I stated he did log into the group' s IRC channe l which he 

believed was via the irc.4chan.org website. I I stated 

there was nothing going on in the chat room and that there was no 
password to get into the chat room. 

I | was asked if other individuals in the house 

would be able to provide information a bout the Internet group _ 

ANONYMOUS. He stated that house mates I I 

I ~1 have also viewed the ANONYMOUS website. 


I I stated that there was about seven computers 

in the house including desktops and laptops. All of the computers 
are in a common area in the basement of the house. The Internet 
connection to the house is provided by COX'COMMUNICATIONS and is at 
least a 15 megabyte connection. They are running a wireless 
network for the laptops and Ethernet to t he desktops w ith the 
router being located in the living room. I I stated that 

there is no password on the router and that the service is probably 

in i ' 


name. 


I I was asked again about his frequency of 

viewing the ANONYMOUS message board or website. He stated that the 
last time he- remembered viewing the website was around New Year's 
Day 2008. I I stated he had been viewing the website for 

at least three years and that he had just stumbled upon the group 
on the Internet. 


I I was asked again about communicating with 

members of the group. He stated that he had added two individuals 
affiliated with the group to his IM list. He stated that he had 
chatted with the two individual via IM every now and then. 

I I later provided a sheet of paper containing contact e- 

mail addresses for what he described as three individ uals _ 

affiliated with ANONYMOUS. The e-mail address es were I I 

| and 


b6 

b7C 


b6 

b7C 


b6 

b7C 


I I was asked if he could provide any information 

pertaining to the group's stance towards the Church of Scientology 
(COS). I I stated that he knows the group doesn't like the 

COS. He stated that the group' s m embership tri ed to bring down the 
COS website in about August 2007. I I stated that people 







